Download PDF
Take the 5-min assessment
[ AI Enablement & Modernization ]

The AI-Fluent PDLC.

Almost every engineering organization has adopted AI, while very few have become fluent with it. The gap between those two things is the subject of this paper.

Read this paper if:

  • Nearly everyone on your team has an AI subscription
  • Cycle times have not reduced and overall productivity gains are elusive
  • You'd like a framework on how to move your team to AI fluency
Most AI spend is concentrated on coding, which is just a fraction of your delivery cycle (6% for the study in this report). Weeks go by in the other 94% of getting your ticket to production. Fluency is when the whole cycle moves faster, without losing trust in what’s delivered.
It is grounded in DORA’s research, experience from our team of AI Forward Deployed Engineers, and our 20+ years of experience building software for highly regulated industries.

Short on time?

Jump to the 3-point summary

Or

Take the 5-minute assessment

Contents.

[CHAPTER 01/06]

Adoption is not fluency

AI spends are concentrated on a small sliver of the delivery cycle associated with writing code. Productivity gains are realized when the entire cycle is compressed.
  • Usage up, delivery unchanged
  • Coding is not the constraint
  • Fluency is speed + trust
DORA and DX are two of the highly reputed research teams tracking AI adoption, and the implications of it on software delivery. 
DORA’s 2025 survey of nearly 5,000 technology professionals found that 90% now use AI at work. Most tellingly, higher AI adoption was found to be associated with both, higher software delivery throughput and also higher delivery instability. This led DORA to conclude that AI is fundamentally an amplifier: it magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones.
According to DX’s Feb 2026 report, AI usage rose 65%, but the quantum of work delivered rose just 7.76%. This is because coding is only ~14% of a developer’s day, and accelerating code generation simply relocates the constraint downstream to review, verification, and integration. Several developers stated that the time saved writing code is now being consumed by the extra scrutiny that AI output demands.
At one of our own healthtech clients, the entire delivery cycle was 11.7 weeks, of which, coding was just 6%. Tickets were spending almost 11 weeks either being stuck in queues, or in manual clarification, verification, reviews, or rework.
AI fluency, is when the entire cycle is compressed, without losing trust in what ships.
Adoption is easy to track: usage, licenses, AI-assisted commits. Fluency is measured by how much of the delivery cycle AI compresses, while stability, maintainability, technical debt and overall system quality improve rather than decline.
The next chapter introduces the core organizational framework required to propel this journey from adoption to fluency.
One caveat before we go further. Since AI amplifies the current state, the system has to be in a state that’s worth amplifying. Continuous delivery, automated tests, small batches, and loosely coupled architecture are table stakes that let teams compound their AI gains. When missing, teams are adding code at a speed that the system can’t absorb. Everything that follows assumes these foundations are in place.

90%

of technology professionals now use AI day to day (DORA 2025)

7.8%

of technology professionals now use AI day to day (DORA 2025)

14%

of technology professionals now use AI day to day (DORA 2025)
[CHAPTER 02/06]

The fluency stack.

Fluency is built on the cultural foundation of an organization, as it applies to capabilities of its people and conduct of its agents.
DORA’s 2025 State of DevOps research published a core organizational model for engineering excellence: Capabilities drive software delivery performance, which drives organizational outcomes. Alongside it, they released an AI Capabilities Model with seven capabilities that amplify AI outcomes: A clear and communicated AI stance, healthy data ecosystems, AI-accessible internal data, strong version control practices, working in small batches, user-centric focus, quality internal platforms.
Our adaptation of the core model, abstracts these capabilities and introduces “Conduct” as an additional layer, which together drive engineering performance.

CAPABILITY

What your people can do with AI across the whole lifecycle, well beyond the coding stage. Judgment, breadth, business grounding, documented context.

CONDUCT

What your systems hold your people and your agents to while they work. Standards, regulations, and data boundaries, enforced as the code is generated.

The next two chapters drill down into these layers to break down what it takes to build these into their organization’s playbook.
[CHAPTER 03/06]

The capability layer.

Capability is what your people can actually do with AI across the whole lifecycle, and it is the first layer an organization is responsible for building.
  • Learning and continuous improvement
  • Skill & judgement
  • Business fluency
  • Knowledge and documentation systems

Foundation:
Culture decides whether any capability takes root

Westrum’s research which DORA has validated over a decade shows that a culture where information flows freely, teams collaborate deeply, and failure is treated as a learning opportunity, the strongest predictor of whether any other capability converts into outcomes.
The strength of an AI-fluent PDLC lies in whether team members can hold each other accountable for what their AI produces. You cannot push sloppy code that raises the team’s review burden, and you cannot let your craft slide because your productivity is being closely monitored. Culture is about having the psychological safety to call this out.
[Our take]

If it isn’t safe to push back when management demands higher AI usage, your stability numbers will soon be doing that job for you.

DIMENSION 01
Learning and continuous improvement
This is about how much your team collectively knows, whether you keep growing it, and how your people build the capability to catch AI’s mistakes before they ship. People who can name the patterns and architectures they work in can direct and check more of what the AI produces.
Leaders have to supply the conditions that enable learning:
Slack Time

Protected hours for hackathons, learning sessions, and trainings, counted as real capacity on the plan.
Learning Budget

Continuous learning carried as an organizational responsibility, with a real budget and cadence behind it.
AI-Centric Hiring

Interviews that test whether a candidate can read and critique a large AI-generated plan, which now matters as much as writing code from scratch.
Cross-functional Pairing

Active pairing across product, development and QA, so teams think of business outcomes and not just ticket completion.
[Our take]
Apprenticeship matters more in the AI era. AI is doing the work juniors used to learn from, so you have to maintain a healthy senior-to-junior ratio and build new learning loops on purpose, or you’ll have no senior engineers in five years.
Most clients begin noticing improvements within the first few weeks. For deeper operational changes, we typically see lasting impact within 2 to 3

01

Reading and judging AI output

Evaluating large AI-generated plans, diffs, and code for correctness and fit. This is fast becoming the core engineering skill, and what the hiring process should test for.

02

Spec and intent authoring

Telling AI what to build clearly enough to get the right result: specifications, constraints, and acceptance criteria. Drive the transition to spec-driven development to leap past prompt-in, code-out.

03

Architecture and systems judgment

Recognizing good structure when you see it and steering AI toward maintainable design instead of a plausible mess.

04

Generalist breadth

A wide surface area across the stack and the SDLC, so one person can direct AI across more of the work and connect the parts.

05

Craft mindset

Caring enough to ensure that the bar is set high for AI generated code, and quality of the codebase doesn't degrade over time.

One of DORA’s seven AI capabilities is a Clear and communicated AI stance. The stance is enforced when the team has the skills and judgement to do so.
As AI absorbs the purely technical work, the edge that’s left is the knowledge AI can’t pull from the codebase or a prompt: how the business actually makes money, how this organization actually works, and the rules of the domain it operates in. With role boundaries blurring across product, engineering, and QA, each person own outcomes and that makes it critical for everyone to be fluent in what problems they are solving for their end users. This fluency is what lets a person direct AI toward the right decisions, and it is what keeps a system built around its domain rather than assembled in isolation.
Decisions grounded in how the business and the system actually work, not just the code, predict rework rate and value delivered. Teams with that grounding build the right thing the first time, making a huge impact on their overall cycle time.
Another of DORA’s seven capabilities, user-centric focus is what business fluency enables, and ensures that AI-accelerated teams are moving quickly in the right direction.

66%

cite “almost right, but not quite” as their top AI frustration · Stack Overflow 2025

75%

would still ask a person when they don’t trust an AI answer · Stack Overflow 2025

~95%

of enterprise GenAI pilots show no measurable return · MIT NANDA 2025
[Our take]
AI commoditizes the tech; the edge is what lives outside the codebase, in your business, your domain, and your engineers’ heads.
The first three dimensions are more about capabilities your people build. This one is about the systems that capture what the organization knows and makes relevant context available to both humans and agents. A model with no access to your architecture decisions, your domain glossary, your past incidents, or your coding standards will produce something generic. The same model, grounded in that context, produces something that fits with minimal reviews and rework.
Leaders build this by treating knowledge as infrastructure:
DORA’s AI-accessible internal data

Making the context an agent needs, code, tickets, docs, and design history, reachable at generation time and always updated.
DORA’s healthy data ecosystems

Clean, well-structured internal data amplifies AI success.
Captured decisions

With the reasoning behind choices written down, the “why” survives past the person who made the call, and is available to agents as invaluable context.
Codified craft

The practices, patterns, and domain rules your best engineers live by, become reusable skills, commands, hooks, and shared memory that every agentic session inherits.
[Our take]
Codifying craft is how a team’s best practices stop being tribal knowledge and become the default.

Modernization is now an AI prerequisite.

Code is the best form of documentation and coding agents can only go as deep as your codebase lets them. A legacy, undocumented, tightly coupled codebase keeps a team stuck at lower levels of fluency, no matter how good the capabilities are. Getting a codebase agent-ready, through documentation, decoupling, and test coverage, is a precondition for fluency, and a subject big enough for its own companion paper.
[OUR TAKE]
What’s good for your engineers is good for your agents. Clear documentation and clean code help both; the messy kind drags both down. AI will quickly help you find out where you stand.
[CHAPTER 04/06]

The Conduct Layer

The enforcement half of fluency: standards, regulations, and data boundaries held while AI generates code, ensuring manual reviews are not the bottlenecks.

  • Coding standards
  • Compliance posture
  • Data and security boundaries
Conduct warrants a layer of its own in the AI era because human reviews can no longer keep pace with what AI generates. Building trust in what AI generates is the way forward.
The capability layer prepared your people and systems for AI. The conduct layer ensures your standards, regulations, guardrails, security rules, data boundaries, are all enforced while AI generates code. The cost of a leak missing human reviews could be catastrophic for a highly regulated domain, and conduct is what reduces the risk.

DIMENSION 01
Coding Standards

Standards are your teams’ agreed upon way of coding. They’re a definition of what good looks like and how to reliably produce it. An agent will produce something that works, or passes tests. Standards are what steer the agent to produce code that your team can continue to own, read and change months later, preventing the slow quality erosion that teams are currently experiencing with higher AI use.
Organizations build this by turning standards into live context:

01

Session-loaded rules

Standards that load into every AI session automatically and render into each tool’s native format, so they are present as the code is written.

02

Org-wide and repo-specific layers

Clarity around what applies across the company versus to this codebase, so the agent applies the right rules contextually.

03

Craft with AI

Practices like Spec-driven development and working in small batches help you shift left on reviews and keep each unit small enough to reduce cognitive load.

One of DORA’s AI capabilities is a clear and communicated AI stance. Chapter 3 argued the stance holds only when people have the skill to enforce it. Conduct is the other half that enforces the stance via rules that the agent follows.

DIMENSION 02
Compliance posture

For compliance heavy domains like healthcare, or fintech, engineers are trained to ensure their code and conduct is compliant with HIPAA, PCI-DSS, SOC 2. The cost of a leak goes up the later it is found.

01

Regulations encoded as guardrails

The frameworks that apply to you, written into rule sets the agent works to as it generates.

02

Audit trails and logging

Logging every prompt, action, and policy decision as the work happens ensures the evidence is always available.

03

DORA's strong version control practices

When every change is small, attributable, and logged with its reasoning, your version history becomes the additional compliance record.

HHS OCR brought 16 HIPAA enforcement actions in 2024 (about $9.4M in penalties), and in late 2024 proposed the first major update to the HIPAA Security Rule in over 20 years (published January 2025). The proposed rule tightens encryption, risk-analysis, and resilience requirements for every system that handles ePHI. This brings AI-enabled teams squarely in scope of audits.
[Our take]
Compliance checked only at review is you relying on the judgement of one human. It takes just one incident to put your business at a serious risk.

DIMENSION 03
Data and security boundaries

An agent does not just read, it acts. It calls models, tools, and outside services, and each call can carry sensitive data out of your boundary or take an action you did not intend it to.
Intentionally govern what is allowed to cross the line:

01

In-flight detection

Define what happens when sensitive data is detected before it leaves the network.

02

Tool and action governance

Deliberately define how every tool and MCP call is allowed to do, with destructive operations blocked across the organization.

03

Own the data boundary

Ensure the whole path runs in your VPC or on-prem, so code and data stay inside.

[Our take]
One prompt with real patient data in a public model is enough to lose your AI mandate. Boundaries are what let you go faster with higher trust in autonomy.

Compliance and audit posture

AI moves PHI into places that matter for audits. In regulated software this outcome is non-negotiable, and AI changes the risk surface in ways most teams haven’t intended.
[Our take]
Conduct has to live at the point of generation, not at the time of PR reviews or quarterly audits.
[CHAPTER 05/06]

Engineering performance

Higher engineering performance is evidence that your capability and conduct layers have been built right.

  • Throughput and cycle time
  • Stability
  • Code quality and technical debt
  • Compliance and audit-readiness
The four DORA metrics: deployment frequency, lead time, change failure rate, and time to restore, track the system’s health and measure a team’s ability to ship fast with safety. An AI-assisted PDLC raises the stakes as there’s a lot more code being generated, and this makes it even more critical to get early signals from these metrics as adoption grows. These are also the right signals on how the team is trending on its journey from adoption to fluency.

01

Throughput and cycle time

The whole cycle compresses, not just the coding sliver.

02

Stability

Change failure rate and time to restore hold as throughput climbs.

03

Code quality and technical debt

The codebase stays ownable months later with sustained developer and agent experience.

04

Compliance and audit-readiness

Compliance posture stays intact with evidence always available.

The next chapter defines our model for fluency and how these performance parameters translate to your team’s AI fluency.
[CHAPTER 06/06]

Reading your fluency

Fluency has two axes: how fast you move across the cycle, and how much of your trust AI has earned.

  • Throughput and cycle time
  • Stability
  • Code quality and technical debt
  • Compliance and audit-readiness

A team can feel fluent and yet, not be.

They may be shipping fast, with healthy dashboards, and high tool usage. Then a change that sailed through review takes down production, and it turns out nobody really knew what the AI had written. That gap, between feeling fluent and being fluent, is what this section helps you see.

Fluency is fast plus trusted.

Fluent

Fast and trusted at once. Its rare and is the target that this paper is advocating for.

Safe but stuck

Correct and sure of it, but slow. Careful teams live here and mistake it for fluency. The work is to speed up without giving up the feeling of safety.

Reckless

Fast on confidence that hasn’t been verified. It looks like success, while quality degrades quietly. The risk of blowing up anytime makes it the most dangerous corner.

Stalled

Slow and unsure. The pace of work is aligned with low confidence. The work here is to build capability and conduct that improve both, flow and trust.

The rest of this chapter helps you discern where your team stands on flow and earned trust.

Flow: the whole cycle moving without friction

Mihaly Csikszentmihalyi described flow as the state where you’re so absorbed in the work that it carries itself.
Work is in flow when a unit of work moves through the whole delivery cycle without stalling: no waiting in a queue, no bouncing back for clarification, no sitting in a review backlog for three days. When work flows, cycle time is low. When it keeps stopping, cycle time balloons, and you get our healthtech client from Chapter 1: 11 of their 11.7 weeks spent stalled, with actual coding taking just 6% of the cycle.
The biggest impact on lower cycle time comes when AI is able to carry a single unit of work on its own, without stalling. These are the five levels we use in our assessment:
The jump from level 3 to level 4 is the one that has the highest impact on compressing the delivery cycle.

Earned Trust: Confidence that matches reality

Confidence on its own tells you nothing, because a team can feel completely sure and be completely wrong. What matters is whether that confidence is calibrated: whether what the team believes about its AI’s output matches what the code actually does.
Earned trust is confidence you can defend, because your verification catches bad outputs, your track record of outputs meeting your AI stance, the amount of rework dropped, and stability of the system didn’t slip as you sped up.

The 3-point summary

Software teams have adopted AI fast, but benefits are still anecdotal. This paper examines why, and what separates the teams that convert AI into delivery gains, from those that do not.

AI Adoption

A large part of the AI budget is currently spent on coding, which is a fraction of the entire delivery cycle. This is why productivity gains are elusive and cycle times are largely unchanged. There are spikes of productivity across the org but these are not predictable and sustained.

Industry metrics on adoption

Foundations for Fluency

Fluency rests on two organizational layers. Capability - the culture, learning, judgement, and documentation practices that let people direct and check AI across the lifecycle. Conduct, the standards, regulatory rules, and guardrails enforced while AI generates code.

DORAs Capability model extended for AI
Building your capability layer
Building your conduct layer

Achieving Fluency

Fluency is when the full delivery cycle is compressed without losing trust in what ships. It can be measured by how much a team trusts the AI-assisted work, along with how much they've been able to reduce their cycle time and enable flow. It can be achieved when organizations build their capability and conduct around AI.

How capability and conduct drive engineering outcomes
Where your team stands on fluency

Answer six questions to understand
where your team stands on their journey from adoption to fluency

Test AI Fluency Now

The offer.
Two ways to install it.

Buy it from Incubyte

Augment your team's capabilities and introduce the conduct layer, as a product. Fully deployed within your security boundary.

Build it with Anthara

Our forward deployed engineers build your capability and conduct layers for you, alongside your team.

[START HERE · FREE]
The Agent
Experience Audit
Book a walkthrough

Methodology and sources.

This brief combines public research with field observations from regulated-software engineering teams. The framework follows DORA’s capabilities → performance → outcomes model, extended with a conduct layer for the AI era. Field observations are illustrative of patterns we see in engagements and are labeled as such, not presented as a controlled study.
[REFERENCES]

1

Delivery lifecycle timings (coding ≈6% of the cycle, 4.68 days inside an ~11.7-week cycle) are from Incubyte’s analysis of an enterprise health-tech client’s delivery pipeline.

2

DORA, 2025 State of AI-Assisted Software Development Report (Google Cloud).

3

DORA, Accelerate State of DevOps Report 2024 (throughput, stability, cluster distribution, anddocumentation findings). dora.dev/research/2024

4

GitHub, Octoverse 2025 (Copilot adoption among new developers and open-source maintainers).

5

Stack Overflow, 2025 Developer Survey (adoption, trust, and frustration figures).

6

McKinsey, The State of AI 2025 (88% adoption in at least one function); MIT NANDA, State of AI in Business 2025 (roughly 95% of generative-AI pilots show no measurable return).

7

DX, AI and Engineering Velocity: A Longitudinal Analysis, 2026 (65% usage rise, 7.76% PR-throughput riseacross400+ companies).

8

CodeRabbit, State of AI vs Human Code Generation, December 2025 (10.83 vs 6.45 issues per PR across470 PRs)

9

Sonar, false-positive analysis, 2026 (3.2% across 137 million issues).

10

METR, Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, July2025.

11

Peng et al., The Impact of AI on Developer Productivity: Evidence from GitHub Copilot, 2023; Cui, Demirer, Jaffe, Musolff, Peng, and Salz, field experiments on generative AI and developer output.

12

Robbes, Matricon, Degueule, Hora, and Zacchiroli, “Agentic Much? Adoption of Coding Agents on GitHub,”arXiv:2601.18341, 2026.

13

HHS OCR, HIPAA Security Rule NPRM fact sheet (December 2024 / January 2025); HIPAA Journal enforcement tracker